PatchRNN: A deep learning-based security patch identification system

The researchers propose a deep learning system, PatchRNN, for automatically identifying "secret" security patches in open-source software that do not document their security impact. In addition to using textual keywords in commit messages, the system also incorporates syntax- and semantics-level features of the source code. Experiments on a large-scale dataset of real patches and a case study on the open-source web server NGINX show that PatchRNN can detect such security patches with a low false positive rate.